Privacy

Last updated 20 September 2026.

The short version

Your PDF is opened, edited and saved inside your browser. It is never uploaded to us, so we cannot read it, store it, lose it or hand it to anyone. We hold the minimum needed to run accounts and count free saves.

What never leaves your device

The PDF itself, at every stage — opening, filling in, signing and saving.
Anything you type into the document.
Your signature image, unless you are on Pro and choose to sync it to your account.
A password you enter to open a protected PDF. It is used once, in the page, and never stored.
Your in-progress work, which is saved in this browser's local storage so a refresh does not lose it.

What we do receive

Export metadata: the page count, the file size in bytes, and a SHA-256 fingerprint of the file. The fingerprint lets us count your free saves and recognise a re-save of the same document; it cannot be turned back into the document.
Account details if you create one: your email address and your billing status.
Saved signatures if you are on Pro and turn on syncing.
Product analytics: anonymous events such as "a document was opened" with its page count, or "an export was blocked". Never document names, never content. Session recording is switched off everywhere on this site.
Standard server logs from our host, including IP address, kept briefly for security and abuse prevention.

Who else is involved

Our hosting provider serves the site and keeps request logs.
Our database and authentication provider stores accounts, subscriptions and export counts.
Our merchant of record handles payment and tax. They receive your payment details; we never see a card number.
Our analytics provider receives the anonymous product events described above, on EU infrastructure.
Our email provider sends sign-in links and receipts.

Your rights

You can ask for a copy of what we hold about you, ask us to correct it, or delete your account and everything attached to it. Deleting the account removes your profile, signatures, saved details and export history. Email us and we will do it — see contact.

Checking the claim yourself

You do not have to take our word for the no-upload claim. Open your browser's developer tools, go to the Network tab, and use the editor. No request carries your document. The page's content security policy also restricts where the page may talk to at all.

Phase two: converting to editable Word

One future feature will break the no-upload rule and will say so clearly at the point of use: converting a PDF into an editable Word document needs a server. When that ships it will be labelled as an upload, restricted to Pro, and the uploaded file will be deleted within 60 minutes. Nothing else will ever upload your document.